Privacy Policy
Last updated August 2026
This Privacy Policy explains how subinc (“subinc”, “we”, “us”) collects, uses, shares, and protects personal data in connection with our website and billing platform. Because subinc provides billing infrastructure, we act as a controller for our website visitors, prospects, and account holders, and as a processor for the customer and transaction data our customers process through the platform. That processing is governed by our Data Processing Addendum.
1. Who we are
subinc is operated by SubincLabs, Inc., 1111b South Governors Ave, STE 33435, Dover, DE 19904, USA. For any privacy question, or to exercise your rights, contact us at support@subinclabs.com.
2. Data we collect
Information you give us: when you submit the contact or waitlist form, or create an account, we collect your name, work email, company, and any message you send. Information we collect automatically: server and security logs (IP address, user agent, request timestamps), and, inside the product, the operational telemetry needed to run it — API request metadata, error traces, and audit records of who did what. Customer data: personal data contained in transactions our customers run through the platform is processed on their behalf as described in the DPA.
3. How we use it
We use personal data to respond to your enquiries and manage the founding-customer waitlist; to provide, operate, secure, and improve the service; to measure and understand website usage; to prevent fraud and abuse and to run sanctions screening where required; and to comply with our legal obligations.
4. Legal bases
Where the GDPR or similar laws apply, we rely on: your consent (for marketing you opt into); our legitimate interests (securing and improving the service, and responding to business enquiries you initiate), balanced against your rights; performance of a contract (to provide the platform to account holders); and compliance with legal obligations.
5. Cookies and analytics
This marketing site runs no analytics, no advertising or cross-site tracking, and no third-party scripts, and it sets no cookies. Our content security policy blocks third-party script and connection sources, so a tracker cannot be added to the site without that policy being changed first. Signed-in areas of the product set only the cookies needed to keep you signed in and to protect the session.
6. Improving the service
We use aggregated and de-identified statistics — request volumes, error rates, feature usage, performance timings — to find defects, size capacity, and decide what to build next. This is derived from operational data and does not identify you or your customers, and we do not use the contents of customer transactions to train models or to build profiles. Where we act as a processor, this is limited to what the DPA permits.
7. Automated processing
Parts of the platform act without a person in the loop: dunning retries, automatic wallet top-ups, spend limits, fraud and risk rules, sanctions screening, and reserve or payout holds. Where such a decision affects an individual significantly, the customer operating the account is the controller and is responsible for review and for handling appeals; we provide the record of what the rule did and why. We do not use these mechanisms to make decisions about visitors to this website.
8. Sharing and subprocessors
We share personal data with service providers who process it on our behalf under contract: hosting, infrastructure, and email delivery. The current list, and the line between our subprocessors and the payment providers a customer connects under its own credentials, is set out on our subprocessors page. We disclose data where required by law or to protect our rights. We do not sell personal data, and we do not share it for cross-context behavioural advertising.
9. International transfers
We and our providers may process personal data in countries other than yours. Where we transfer data internationally, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, and apply supplementary measures where needed.
10. Retention
We keep personal data only as long as necessary for the purposes above or as required by law. Contact and waitlist submissions are retained while we evaluate the enquiry and deleted on request or when no longer needed; account data is retained for the life of the account plus any legally required period; logs are kept for a limited period for security and diagnostics.
11. Your rights
Subject to applicable law, you may request access to, correction of, deletion of, or a copy of your personal data; restrict or object to certain processing; and withdraw consent at any time without affecting prior processing. You also have the right to complain to your data protection authority. To exercise any right, email support@subinclabs.com; we respond within the timelines the law requires.
12. How we protect data
The platform is built for the failure modes that lose money and leak data: tenant isolation enforced at the database (row-level security), encryption in transit, role-based access control, and a hash-chained audit log. Card data never touches our systems — it is tokenized by the payment gateway, so we never store a card number or CVV (PCI scope minimization).
13. Children
The service is intended for businesses and is not directed to children under 16. We do not knowingly collect personal data from children; if you believe a child has provided us data, contact us and we will delete it.
14. Changes to this policy
We may update this policy from time to time. The “last updated” date at the top reflects the current version, and we will provide additional notice where changes are material.
15. Contact
Questions, requests, or complaints: support@subinclabs.com, or by post to SubincLabs, Inc., 1111b South Governors Ave, STE 33435, Dover, DE 19904, USA.
Questions about this document: support@subinclabs.com